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DETAILED ACTION 

Response to Arguments 

1 . Applicant's arguments filed 10/28/2008 have been fully considered but they are not 
persuasive. Applicant argues that claims as amended are not taught by the references. However, 
examiner disagrees. The amended claims are discussed in the office action below. 

2. Examiner withdraws objection to Abstract in light of amended abstract. 

Claim Rejections - 35 USC § 103 

3. The text of those sections of Title 35, U.S. Code not included in this action can be found 
in a prior Office action. 

4. Claims 2-5, 7, 10, 1 1, 16, 18-22, 24, 27, 28, 33-37, 39, 42, 43, 48-50, 52 are rejected 
under 35 U.S.C. 103(a) as being unpatentable over Ocepek et al. (USPN 7,124,197) in view of 
Gray et al. (USPN 7,295,524) and Jennings et al. (USPN 6,580,712). 

Regarding claim 2, Ocepek teaches a method for detecting a wireless access device on a 
network [Col. 5, lines 14-15], the method comprising: storing one or more organizationally 
unique identifiers [Fig. 11, stores MAC addresses which identify the device]; receiving from 
the network a packet with an address [Fig. 6, Source field is an address field which is received 
by security device as stated in Col. 7, lines 39-40]; determining an operating system associated 
with the received address, when comparing the received address results in a match between the 
received address and at least one of the registered addresses [Col. 8, lines 59-63, source MAC 
address can be used to determine operating system Col. 7, lines 43-44]; comparing the 
determined operating system with one or more stored operating systems, such that at least one of 
the stored operating systems corresponds to the device [Col. 8, lines 63-65, MAC address is 
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used to determine and compare operating system as discussed in Col. 7, lines 43-44, each 
MAC address can tell the operating system since specific manufactures are assigned 
particular series of MAC addresses as applicant discussed in his application]; and indicating 
that the received packet corresponds to the device when the determined operating system 
matches at least one of the stored operating systems [Col. 7, lines 43-55] . 

However, Ocepek does not teach in Col. 7, lines 43-55 does not teach that the device is a 
wireless access device rather teaches the device is a server and does not teach determining a 
wireless device based on the first three octets of the address; organizationally unique identifiers 
comprise the first three octets of one or more registered addresses; searching the identifiers, 
wherein a more frequently encountered identifier is searched before a less frequently 
encountered identifier; comparing the first three octets of the received address with the 
identifiers determining if the received address includes one of the stored identifiers. 

Ocepek teaches the device can be wireless access device [Fig. 1, 20, since WAP has a 
MAC address the same concept can be used to identify a wireless device] and Gray teaches 
determining a wireless device based on the first three octets of the address and organizationally 
unique identifiers comprise the first three octets of one or more registered addresses [Col. 14, 
lines 12-25]; comparing the first three octets of the received address with the identifiers 
determining if the received address includes one of the stored identifiers [Col 14, lines 12-25, 
compares the first three octets to determine if access point matches and identifiers are 
stored since they are matched to a database] . Jennings teaches searching the identifiers, 
wherein a more frequently encountered identifier is searched before a less frequently 
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encountered identifier [Col. 5, lines 50-52, first portion of MAC address has organizationally 
unique identifier] . 

It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to have a check for the wireless access device so that intruder can be prevented from 
gaining access to internal server and servers can be protected [Col. 2, lines 16-20] and to match 
the first three octets to determine if the device is a wireless device since first three octets can 
identify WLAN manufacturer of the device which enables to determine if the device is a WLAN 
device [Col. 14, lines 12-15] and to store such that more frequently used identifiers are searched 
first to improve the performance of searching [Col. 5, lines 47-48]. 

Regarding claims 3, 20, 35, Ocepek teaches receiving the address with information 
identifying a source of a packet [Col. 8, lines 57-59]. 

Regarding claims 4, 21, 36, Ocepek teaches using an organizationally unique identifier 
as the information identifying the source [Col. 8, lines 57-59, MAC address' first portion has 
organizationally unique identifier]. 

Regarding claims 5, 22, 37, Ocepek teaches receiving the address based on passively 
monitoring the network [Col. 5, lines 22-26] . 

Regarding claims 7, 24, 39, Ocepek teaches determining whether a first organizationally 
unique identifier of the address is similar to a second organizationally unique identifier of at least 
one of the registered addresses [Col. 8, lines 63-65, MAC address has an organizational 
unique identifier in its first portion] . 
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Regarding claims 10, 27, 42, Ocepek teaches indicating the wireless access device is not 
authorized on the network [Col. 8, lines 59-63, a Null value of MAC address indicates the 
wireless device is not authorized yet] . 

Regarding claims 11, 28, 43, Ocepek teaches storing the one or more registered 
addresses, such that the one or more registered addresses are searchable [Fig. 11, Col. 10, lines 
49-51]. 

Regarding claims 16, 33, 48, Jennings teaches storing the stored operating system, such 
that a more frequently encountered stored operating system is searched before a less frequently 
encountered stored operating system [Col. 5, lines 50-52, MAC address can be used to 
determine operating system which is well-know in the art and applicant discusses this in his 
specification also and by storing the MAC addresses that are accessed most, the stored 
operating system will be stored in a such a way also]. 

It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to store such that more frequently used identifiers are searched first to improve the 
performance of searching [Col. 5, lines 47-48]. 

Regarding claim 18, Ocepek teaches a system for detecting a wireless access device on a 
network [Col. 5, lines 14-15], the method comprising: means for storing one or more 
organizationally unique identifiers [Fig. 11, stores MAC addresses which identify the device]; 
means for receiving from the network a packet with an address [Fig. 6, Source field is an 
address field which is received by security device as stated in Col. 7, lines 39-40]; means for 
determining an operating system associated with the received address, when comparing the 
received address results in a match between the received address and at least one of the 
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registered addresses [Col. 8, lines 59-63, source MAC address can be used to determine 
operating system Col. 7, lines 43-44]; means for comparing the determined operating system 
with one or more stored operating systems, such that at least one of the stored operating systems 
corresponds to the device [Col. 8, lines 63-65, MAC address is used to determine and 
compare operating system as discussed in Col. 7, lines 43-44, each MAC address can tell the 
operating system since specific manufactures are assigned particular series of MAC 
addresses as applicant discussed in his application]; and means for indicating that the received 
packet corresponds to the device when the determined operating system matches at least one of 
the stored operating systems [Col. 7, lines 43-55] . 

However, Ocepek does not teach in Col. 7, lines 43-55 does not teach that the device is a 
wireless access device rather teaches the device is a server and does not teach determining a 
wireless device based on the first three octets of the address; organizationally unique identifiers 
comprise the first three octets of one or more registered addresses; means for searching the 
identifiers, wherein a more frequently encountered identifier is searched before a less frequently 
encountered identifier; means for comparing the first three octets of the received address with the 
identifiers determining if the received address includes one of the stored identifiers. 

Ocepek teaches the device can be wireless access device [Fig. 1, 20, since WAP has a 
MAC address the same concept can be used to identify a wireless device] and Gray teaches 
determining a wireless device based on the first three octets of the address and organizationally 
unique identifiers comprise the first three octets of one or more registered addresses [Col. 14, 
lines 12-25]; means for comparing the first three octets of the received address with the 
identifiers determining if the received address includes one of the stored identifiers [Col 14, lines 
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12-25, compares the first three octets to determine if access point matches and identifiers 
are stored since they are matched to a database]. Jennings teaches means for searching the 
identifiers, wherein a more frequently encountered identifier is searched before a less frequently 
encountered identifier [Col. 5, lines 50-52, first portion of MAC address has organizationally 
unique identifier] . 

It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to have a check for the wireless access device so that intruder can be prevented from 
gaining access to internal server and servers can be protected [Col. 2, lines 16-20] and to match 
the first three octets to determine if the device is a wireless device since first three octets can 
identify WLAN manufacturer of the device which enables to determine if the device is a WLAN 
device [Col. 14, lines 12-15] and to store such that more frequently used identifiers are searched 
first to improve the performance of searching [Col. 5, lines 47-48]. 

Regarding claim 19, Ocepek teaches a system for detecting a device on a network 
[Abstract], said system comprising: at least one memory [Fig. 7, 102, Col. 7, lines 60-62] 
comprising: code that stores one or more organizationally unique identifiers [Fig. 11, stores 
MAC addresses which identify the device]; code that receives from the network a packet with 
an address [Fig. 6, Source field is an address field which is received by security device as 
stated in Col. 7, lines 39-40] ; code that determines an operating system associated with the 
received address, when comparing the received address results in a match between the received 
address and at least one of the registered addresses [Col. 8, lines 59-63, source MAC address 
can be used to determine operating system Col. 7, lines 43-44]; code that compares the 
determined operating system with one or more stored operating systems, such that at least one of 
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the stored operating systems corresponds to the device [Col. 8, lines 63-65, MAC address is 
used to determine and compare operating system as discussed in Col. 7, lines 43-44, each 
MAC address can tell the operating system since specific manufactures are assigned 
particular series of MAC addresses as applicant discussed in his application]; and code that 
indicates that the received packet corresponds to the device when the determined operating 
system matches at least one of the stored operating systems [Col. 7, lines 43-55] . 

However, Ocepek does not teach in Col. 7, lines 43-55 does not teach that the device is a 
wireless access device rather teaches the device is a server and does not teach determining a 
wireless device based on the first three octets of the address; organizationally unique identifiers 
comprise the first three octets of one or more registered addresses; code that searches the 
identifiers, wherein a more frequently encountered identifier is searched before a less frequently 
encountered identifier; code that compares the first three octets of the received address with the 
identifiers determining if the received address includes one of the stored identifiers. 

Ocepek teaches the device can be wireless access device [Fig. 1, 20, since WAP has a 
MAC address the same concept can be used to identify a wireless device] and Gray teaches 
determining a wireless device based on the first three octets of the address and organizationally 
unique identifiers comprise the first three octets of one or more registered addresses [Col. 14, 
lines 12-25]; code that compares the first three octets of the received address with the identifiers 
determining if the received address includes one of the stored identifiers [Col 14, lines 12-25, 
compares the first three octets to determine if access point matches and identifiers are 
stored since they are matched to a database]. Jennings teaches code that searches the 
identifiers, wherein a more frequently encountered identifier is searched before a less frequently 
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encountered identifier [Col. 5, lines 50-52, first portion of MAC address has organizationally 
unique identifier] . 

It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to have a check for the wireless access device so that intruder can be prevented from 
gaining access to internal server and servers can be protected [Col. 2, lines 16-20] and to match 
the first three octets to determine if the device is a wireless device since first three octets can 
identify WLAN manufacturer of the device which enables to determine if the device is a WLAN 
device [Col. 14, lines 12-15] and to store such that more frequently used identifiers are searched 
first to improve the performance of searching [Col. 5, lines 47-48]. 

Regarding claim 34, Ocepek teaches a computer program product, tangibly embodied in 
a computer-readable storage medium for detecting a device on a network [Fig. 7, 102], the 
computer program product comprising: code that stores one or more organizationally unique 
identifiers [Fig. 11, stores MAC addresses which identify the device]; code that receives from 
the network a packet with an address [Fig. 6, Source field is an address field which is received 
by security device as stated in Col. 7, lines 39-40]; code that determines an operating system 
associated with the received address, when comparing the received address results in a match 
between the received address and at least one of the registered addresses [Col. 8, lines 59-63, 
source MAC address can be used to determine operating system Col. 7, lines 43-44]; code 
that compares the determined operating system with one or more stored operating systems, such 
that at least one of the stored operating systems corresponds to the device [Col. 8, lines 63-65, 
MAC address is used to determine and compare operating system as discussed in Col. 7, 
lines 43-44, each MAC address can tell the operating system since specific manufactures 
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are assigned particular series of MAC addresses as applicant discussed in his application]; 

and code that indicates that the received packet corresponds to the device when the determined 
operating system matches at least one of the stored operating systems [Col. 7, lines 43-55] . 

However, Ocepek does not teach in Col. 7, lines 43-55 does not teach that the device is a 
wireless access device rather teaches the device is a server and does not teach determining a 
wireless device based on the first three octets of the address; organizationally unique identifiers 
comprise the first three octets of one or more registered addresses; code that searches the 
identifiers, wherein a more frequently encountered identifier is searched before a less frequently 
encountered identifier; code that compares the first three octets of the received address with the 
identifiers determining if the received address includes one of the stored identifiers. 

Ocepek teaches the device can be wireless access device [Fig. 1, 20, since WAP has a 
MAC address the same concept can be used to identify a wireless device] and Gray teaches 
determining a wireless device based on the first three octets of the address and organizationally 
unique identifiers comprise the first three octets of one or more registered addresses [Col. 14, 
lines 12-25]; code that compares the first three octets of the received address with the identifiers 
determining if the received address includes one of the stored identifiers [Col 14, lines 12-25, 
compares the first three octets to determine if access point matches and identifiers are 
stored since they are matched to a database] . Jennings teaches code that searches the 
identifiers, wherein a more frequently encountered identifier is searched before a less frequently 
encountered identifier [Col. 5, lines 50-52, first portion of MAC address has organizationally 
unique identifier] . 
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It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to have a check for the wireless access device so that intruder can be prevented from 
gaining access to internal server and servers can be protected [Col. 2, lines 16-20] and to match 
the first three octets to determine if the device is a wireless device since first three octets can 
identify WLAN manufacturer of the device which enables to determine if the device is a WLAN 
device [Col. 14, lines 12-15] and to store such that more frequently used identifiers are searched 
first to improve the performance of searching [Col. 5, lines 47-48]. 

Regarding claim 49, Ocepek teaches a system comprising: a network [Fig. 7, 12]; and a 
processor connected to the network, the processor comprising: means for storing one or more 
organizationally unique identifiers [Fig. 11, stores MAC addresses which identify the device]; 
means for receiving from the network a packet with an address [Fig. 6, Source field is an 
address field which is received by security device as stated in Col. 7, lines 39-40]; means for 
determining an operating system associated with the received address, when comparing the 
received address results in a match between the received address and at least one of the 
registered addresses [Col. 8, lines 59-63, source MAC address can be used to determine 
operating system Col. 7, lines 43-44] ; means for comparing the determined operating system 
with one or more stored operating systems, such that at least one of the stored operating systems 
corresponds to the device [Col. 8, lines 63-65, MAC address is used to determine and 
compare operating system as discussed in Col. 7, lines 43-44, each MAC address can tell the 
operating system since specific manufactures are assigned particular series of MAC 
addresses as applicant discussed in his application]; and means for indicating that the received 
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packet corresponds to the device when the determined operating system matches at least one of 
the stored operating systems [Col. 7, lines 43-55]. 

However, Ocepek does not teach in Col. 7, lines 43-55 does not teach that the device is a 
wireless access device rather teaches the device is a server and does not teach determining a 
wireless device based on the first three octets of the address; organizationally unique identifiers 
comprise the first three octets of one or more registered addresses; means for searching the 
identifiers, wherein a more frequently encountered identifier is searched before a less frequently 
encountered identifier; means for comparing the first three octets of the received address with the 
identifiers determining if the received address includes one of the stored identifiers. 

Ocepek teaches the device can be wireless access device [Fig. 1, 20, since WAP has a 
MAC address the same concept can be used to identify a wireless device] and Gray teaches 
determining a wireless device based on the first three octets of the address and organizationally 
unique identifiers comprise the first three octets of one or more registered addresses [Col. 14, 
lines 12-25]; means for comparing the first three octets of the received address with the 
identifiers determining if the received address includes one of the stored identifiers [Col 14, lines 
12-25, compares the first three octets to determine if access point matches and identifiers 
are stored since they are matched to a database] . Jennings teaches means for searching the 
identifiers, wherein a more frequently encountered identifier is searched before a less frequently 
encountered identifier [Col. 5, lines 50-52, first portion of MAC address has organizationally 
unique identifier] . 

It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to have a check for the wireless access device so that intruder can be prevented from 
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gaining access to internal server and servers can be protected [Col. 2, lines 16-20] and to match 
the first three octets to determine if the device is a wireless device since first three octets can 
identify WLAN manufacturer of the device which enables to determine if the device is a WLAN 
device [Col. 14, lines 12-15] and to store such that more frequently used identifiers are searched 
first to improve the performance of searching [Col. 5, lines 47-48]. 

Regarding claim 50, Ocepek teaches a system comprising: a network [Fig. 1, 12]; a first 
processor interfaced to the network [Fig. 1, 24, Col. 4, lines 57-60, client device has a 
processor since it performs the task described in above mentioned lines]; and a second 
processor interfaced to the network, wherein the second processor receives one or more packets, 
with an address, from the network and the first processor [Fig. 7, 134, Fig. 7 is a diagram of 
security device 10], the second processor: stores one or more organizationally unique identifiers 
[Fig. 11, stores MAC addresses which identify the device]; receives a packet with an address 
from the first processor via the network [Fig. 6, Source field is an address field which is 
received by security device as stated in Col. 7, lines 39-40]; determines an operating system 
associated with the received address, when comparing the received address results in a match 
between the received address and at least one of the registered addresses [Col. 8, lines 59-63, 
source MAC address can be used to determine operating system Col. 7, lines 43-44]; 
compares the determined operating system with one or more stored operating systems, such that 
at least one of the stored operating systems corresponds to an operating system of the first 
processor [Col. 8, lines 63-65, MAC address is used to determine and compare operating 
system as discussed in Col. 7, lines 43-44, each MAC address can tell the operating system 
since specific manufactures are assigned particular series of MAC addresses as applicant 
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discussed in his application] ; and indicates that the first processor corresponds to the device 
when the determined operating system matches at least one of the stored operating systems [Col. 
7, lines 43-55]. 

However, Ocepek does not teach in Col. 7, lines 43-55 does not teach that the device is a 
wireless access device rather teaches the device is a server and does not teach determining a 
wireless device based on the first three octets of the address; organizationally unique identifiers 
comprise the first three octets of one or more registered addresses; searches the identifiers, 
wherein a more frequently encountered identifier is searched before a less frequently 
encountered identifier; compares the first three octets of the received address with the identifiers 
determining if the received address includes one of the stored identifiers. 

Ocepek teaches the device can be wireless access device [Fig. 1, 20, since WAP has a 
MAC address the same concept can be used to identify a wireless device] and Gray teaches 
determining a wireless device based on the first three octets of the address and organizationally 
unique identifiers comprise the first three octets of one or more registered addresses [Col. 14, 
lines 12-25]; compares the first three octets of the received address with the identifiers 
determining if the received address includes one of the stored identifiers [Col 14, lines 12-25, 
compares the first three octets to determine if access point matches and identifiers are 
stored since they are matched to a database]. Jennings teaches searches the identifiers, 
wherein a more frequently encountered identifier is searched before a less frequently 
encountered identifier [Col. 5, lines 50-52, first portion of MAC address has organizationally 
unique identifier] . 
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It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to have a check for the wireless access device so that intruder can be prevented from 
gaining access to internal server and servers can be protected [Col. 2, lines 16-20] and to match 
the first three octets to determine if the device is a wireless device since first three octets can 
identify WLAN manufacturer of the device which enables to determine if the device is a WLAN 
device [Col. 14, lines 12-15] and to store such that more frequently used identifiers are searched 
first to improve the performance of searching [Col. 5, lines 47-48]. 

Regarding claim 52, Ocepek teaches a computer program product, tangibly embodied in 
a computer-retable storage medium, for detecting a device on a network and containing 
instructions which, when executed on a processor, perform a method [Fig. 7, 102] comprising: 
storing one or more organizationally unique identifiers [Fig. 11, stores MAC addresses which 
identify the device] ; receiving from the network a packet with an address [Fig. 6, Source field 
is an address field which is received by security device as stated in Col. 7, lines 39-40]; 
determining an operating system associated with the received address, when comparing the 
received address results in a match between the received address and at least one of the 
registered addresses [Col. 8, lines 59-63, source MAC address can be used to determine 
operating system Col. 7, lines 43-44]; comparing the determined operating system with one or 
more stored operating systems, such that at least one of the stored operating systems corresponds 
to the device [Col. 8, lines 63-65, MAC address is used to determine and compare operating 
system as discussed in Col. 7, lines 43-44, each MAC address can tell the operating system 
since specific manufactures are assigned particular series of MAC addresses as applicant 
discussed in his application]; and indicating that the received packet corresponds to the device 
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when the determined operating system matches at least one of the stored operating systems [Col. 
7, lines 43-55]. 

However, Ocepek does not teach in Col. 7, lines 43-55 does not teach that the device is a 
wireless access device rather teaches the device is a server and does not teach determining a 
wireless device based on the first three octets of the address; organizationally unique identifiers 
comprise the first three octets of one or more registered addresses; searching the identifiers, 
wherein a more frequently encountered identifier is searched before a less frequently 
encountered identifier; comparing the first three octets of the received address with the 
identifiers determining if the received address includes one of the stored identifiers. 

Ocepek teaches the device can be wireless access device [Fig. 1, 20, since WAP has a 
MAC address the same concept can be used to identify a wireless device] and Gray teaches 
determining a wireless device based on the first three octets of the address and organizationally 
unique identifiers comprise the first three octets of one or more registered addresses [Col. 14, 
lines 12-25]; comparing the first three octets of the received address with the identifiers 
determining if the received address includes one of the stored identifiers [Col 14, lines 12-25, 
compares the first three octets to determine if access point matches and identifiers are 
stored since they are matched to a database]. Jennings teaches searching the identifiers, 
wherein a more frequently encountered identifier is searched before a less frequently 
encountered identifier [Col. 5, lines 50-52, first portion of MAC address has organizationally 
unique identifier] . 

It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to have a check for the wireless access device so that intruder can be prevented from 
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gaining access to internal server and servers can be protected [Col. 2, lines 16-20] and to match 
the first three octets to determine if the device is a wireless device since first three octets can 
identify WLAN manufacturer of the device which enables to determine if the device is a WLAN 
device [Col. 14, lines 12-15] and to store such that more frequently used identifiers are searched 
first to improve the performance of searching [Col. 5, lines 47-48]. 

5. Claims 6, 23, 38 are rejected under 35 U.S.C. 103(a) as being unpatentable over Ocepek 
et al. (USPN 7,124,197) in view of Gray et al. (USPN 7,295,524) and Jennings et al. (USPN 
6,580,712) and Moran (USPN 6,009,423). 

Regarding claims 6, 23, 38, the references teach a method, a system and a computer 
program product as discussed in rejection of claim 2, 19, 34 respectively. 

However, the references do not teach comparing the address further comprises: 
determining whether a portion of the address is similar to a portion of at least one of the 
registered addresses. 

Moran teaches comparing based on determination of whether a portion of the address is 
similar to a portion of at least one of the registered addresses [Col. 4, lines 27-34] . 

It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to match only a portion of the address so that only small search tables would have to 
be searched [Col. 4, lines 56-67 - Col. 5, lines 1-2]. 
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6. Claims 8, 25, 40 are rejected under 35 U.S.C. 103(a) as being unpatentable over Ocepek 
et al. (USPN 7,124,197) in view of Gray et al. (USPN 7,295,524) and Jennings et al. (USPN 
6,580,712) and Lausier (USPN 7,174,373). 

Regarding claims 8, 25, 40, the references teach a method, a system and a computer 
program product as discussed in rejection of claim 2, 19, 34 respectively. 

However, the references do not teach determining the operating system at the IP address 
associated with the address. 

Lausier teaches determining the operating system at the IP address associated with the 
address [Col. 29, lines 20-25]. 

It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to determine the operating system associated with the IP address so that components 
of IP address can be assigned to a specific server [Col. 29, lines 43-48]. 

7. Claims 9, 26, 41 are rejected under 35 U.S.C. 103(a) as being unpatentable over Ocepek 
et al. (USPN 7,124,197) in view of Gray et al. (USPN 7,295,524) and Jennings et al. (USPN 
6,580,712) and Lausier (USPN 7,174,373) as applied to claim 8 above, and further in view of 
Tarquini et al. (USPG-PUB 2003/0101353). 

Regarding claims 9, 26, 41, the references a method, a system and a computer program 
product as discussed in rejection of claims 8, 25, 34 respectively. 

However, the references do not teach determining the operating system using an nmap. 
Tarquini teaches determining the operating system using an nmap [Page 7-8, Paragraph 

45]. 
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It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to determine the operating system using nmap so that it could be determined what 
operating system is a device running [Page 3, Paragraph 13] . 

Conclusion 

8. THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within TWO 
MONTHS of the mailing date of this final action and the advisory action is not mailed until after 
the end of the THREE-MONTH shortened statutory period, then the shortened statutory period 
will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 
CFR 1 .136(a) will be calculated from the mailing date of the advisory action. In no event, 
however, will the statutory period for reply expire later than SIX MONTHS from the mailing 
date of this final action. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Chandrahas Patel whose telephone number is (571)270-121 1. 
The examiner can normally be reached on Monday through Thursday 7:30 to 17:00 EST. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Ricky Ngo can be reached on 571-272-3 139. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 
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Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would 
like assistance from a USPTO Customer Service Representative or access to the automated 
information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 

/Ricky Ngo/ 

Supervisory Patent Examiner, Art Unit 
2416 



/Chandrahas Patel/ 
Examiner, Art Unit 24 1 6 



